Reclaim Windows10
gist.github.com
gist.github.com
It then proceeds to set your current network as Private (aka "open all the ports") regardless of which network you're connected to - hope you're at home! Other changes are completely superfluous, like disabling "3D Objects" which has already been disabled in the latest Windows version
Just don't run this stuff.
As with all these things, the road to hell is paved with good intentions, apparently by tinfoil hatted nut jobs who don’t understand the problem domain well enough to be making decisions for people who know even less than they do.
Do you have a rec or a resource? I haven't looked seriously at this so if it's just like "google it" mea culpa, but it seems like there's a lot of misinformation and what not out there. I saw "O&O ShutUp10" in a sibling thread?
You can see a lot of the kinds of telemetry that Windows is interested in if you go to Event Viewer => Application Logs => Microsoft => Windows, if you read it you see that it's like, Google Lighthouse style stuff, to make Windows faster and more reliable
Use these scripts to figure out the kinds of things you don't want to run, then make really targeted "Disable This" choices
I have issue with Facebook and Google blatantly collecting whatever they can to build profiles of us all to shove advertising down our throat that isn’t even relevant to us.
maybe if MS wanted people to believe that, they wouldn't put so much advertising in their OS
Edit: (seen the articles about it but never actually seen it in Windows)
I don't think there's an up to date resource describing all these tweaks. My recommendations:
- Use the original script, it's slightly more up to date, last update was in november 2020: https://github.com/Disassembler0/Win10-Initial-Setup-Script - Read it's library of tweaks, especially the notes about potential unwanted side effects in comments. If you don't understand what each feature does, google it. The tweaks are grouped. - Don't enable any tweak where you don't understand what it does, especially in the security and network tweaks categories.
you can get slim builds with chrome ready to go already, builds with all these cleanup scripts configured, and more
sadly, they also know people in a rush are looking for this or prefer it, and they install backdoors or ways to steal your crypto on them and stuff
I wouldn't even trust the scripts itself at this point, so I'm another for just don't run this stuff
as consensus has flipped multiple times since I posted it, it makes me wonder if other people misread my comment
The scripts (they are mostly forks of https://github.com/Disassembler0/Win10-Initial-Setup-Script) are nicely written toggles for registry values or GPO, that you can read and selectively all. Nothing scary.
When you make it hard to trust the system, people will look at any component that seems unnecessary. They might not know what it is, but they don't trust it anymore. So it might as well get disabled. You know, to be safe.
But at the end of the day I suppose it's only a small percent of users, isn't it? I'm sure the aggressive push for automatic updates — replacing the "Cancel" button by "Maybe Later", and the "Maybe Later" by "You have 2 minutes" — has worked miracles.
So I think we can expect more of this in the future, and the scripts will get even more paranoid in response. What an antagonistic situation.
Privacy scripts are a very common attack vector due to their popularity these days.
Not to mention that the benefits of these “tweaks” is negligible at best.
I don't know what happened to the idea of user friendly software respecting the intentions of a user. Modern OSes really are effectively just well funded socially acceptable malware.
The problem is these 'solutions' never go away. They are never revisited. So people just keep applying them because 15 years ago they had an issue with them.
Appreciate the utility you pointed out, will happily look into it.
If you need to search local ntfs drive, try https://sourceforge.net/projects/swiftsearch/
It does not build any indexes, and always shows up to date results (by scanning MFT)
So regardless of the metrics that support such practice, and casting aside the thousands of people that have routinely seen benefit from the practice, Windows can't be optimized further by the end-user?
As someone who has never encountered a well optimized Microsoft product, and as someone who has routinely had to modify their off-the-shell installs, color me suspicious.
(Agreed, the shady practices and over-zealous disabling of services should stop; but come on -- the end user occasionally understands what they need to do better than the engineer that sold them a generic tool to facilitate generic computer-enabled work.)
This is an outdated fork of a configurable script that I use to do initial config of my windows 10 machines. But I've created my own config saying which functions to run and which not to run based on reading what each function actually does. I'm an IT pro, I knew how to do most of these tweaks in windows settings or group policy, but it's still easier to just run a script than to perform hundreds of clicks, especially when the settings get reorganized in every other windows update.
And as this is HN, I expect lots of people here being IT pros, so I would correct you here: Don't run this stuff if you don't understand what it does.
> Disabling Telemetry breaks Windows updates
> Automatic web searches in start menu
> Application suggestions are silently installed (wat?)
> Allow MS to collect activity history
> Location tracking
> Map updates (who the fuck uses maps on a PC?)
> Tailored experiences (apparently spamming ads on a desktop OS is an experience)
> Advertising ID
> Cortana
This is just from skimming the list for 5 minutes. Not even sure what else is in there.
Seems to who?
Really the only thing different is Apple has made it seem beneficial to users where Microsoft just comes off spammy.
They ask two questions:
* send telemetry to Apple;
* allow sharing telemetry with app developers.
If you don't agree with the first one, the second one is grayed out.
wrt advertiserid, that's iOS/iPadOS only, on macOS it retuns zero-filled UUID.
Eh, I mean they just recently made it effectively useless on iOS (requires a prompt before it works; unsurprisingly very few users give permission). Not sure why they'd go the other direction on MacOS... I suspect it's just there for Catalyst compatibility.
Who doesn't?
Using bing maps via the bloatware app... not used by ordinary people.
I purposely disable SmartScreen because I don't need information about applications I'm running shipped off to Microsoft. Setting the current network to private is handy after a first-time install since Windows often doesn't prompt and defaults to public.
SmartScreen sends all your file hashes and unique computer info to Microsoft. If you're not stepping into weird links and running weird executables it's really not doing much for you.
Naturally I trust both of them more than so called SmartScreen because unlike Smartscreen, I can inspect their code. Yes, the binaries can contain malware, but the first principles tell me that trustability score is inverse of what is being reported by MS.
Naturally I have disabled Smartscreen and Windows defender and admin rights alerts and bajilion things that internet gurus will tell me not to because I don't know what's good for me. Needless to say, my PC runs faster, calmer and is actually malware free because I don't run unauditable things like Smartscreen on it.
Edit: I get WinMerge binary from GitHub repo, and KDiff3 from official website. As trusted as it can get, short of compiling myself.
This is a work machine so I can't control most of Windows behavior. Personal machine runs NixOS for 90% tasks + Windows dual boot for games without connecting to network because I can't be bothered with disabling Smartscreen and defender every other week.
I've got WinMerge installed on my machines and I've never had that issue. Are you sure you're using trusted sources?
> I got Winmerge binary directly from GitHub repo. As trusted as it gets, short of compiling myself.
So, you don't actually know what code you're running and that binary actually could be malware.
So if an untrusted source tells me that a usually varifuably trustable source is not to be trusted, whom do I trust more?
I honestly don't understand how you've made this an adversarial situation. It's almost as if you take offense to Smartscreen telling you it doesn't trust your binary.
The system is pretty straight forward, Smartscreen checks the file source against a list of known bad actors. If there's a hit it's saying "I can't vouch for this".
I checked and WinMerge isn't flagged in Smartscreen. The publisher however does not use a signing certificate which results in a UAC prompt.
In any case neither of these features prevent installation, they're just warnings you can circumvent.
Copy the application out of the disk image first. Verifying the application (and running it) will be much faster.
Like I found that SmartScreen and defender blocked my ethminer but that is in general pretty smart because it is common to have it unwittingly installed, and I simply said it is OK to run.
Conversely, just because something is used more, does that get the automatic stamp of approval? More than 2 Billion people use Facebook every month, do you consider FB to be more likely to be good for someone? What kind of messed up logic is that?
Showing a warning about anything is not value neutral. Showing a popup for infrequently used software says that you value number of users as a measure of software quality.
Fortunately you can just disable it from the settings though.
You should only be installing verified trusted apps you can verify the sources or hash for, farming this out to a third party, even if its MS, is a great way to open yourself up to watering hole attacks.
Furthermore, you are encouraging poor user behaviour with "oh man this app said my app is good" and then ending up with all manner of poorly vetted bloatware, not to mention antitrust and legal issues.
Really it should be possible to completely remove and/or replace this whole component.
As for network, why aren't running from behind a properly secured connection? That's just bad practice. If you want to connect from a coffeeshop or whatever, set your firewall to block everything by default.
> SmartScreen, a service that absolutely should not be disabled unless you want your machine to get owned
It's not hard for people, especially ones who read HN, to be perfectly safe with SmartScreen disabled.
You can't say anything like that without context.
SmartScreen and defender are the first things to go on my machine as they slow down computer at least by the factor of 2, if not more.
People on HN generally don't need babysitting!. Know where you are.
> need me to LMGTFY
You've provided zero evidence to the contrary. The burden of proof is on you.
> As far as I can tell, as long as Windows Defender (and presumably other A/V scanners) are running, there's no way to make the Windows I/O APIs consistently fast.
https://gregoryszorc.com/blog/2021/04/06/surprisingly-slow/
This is really even a common knowledge - if you did ANY IT work, you should already know it. I can't count the number of times when server wasn't working correctly when it turns out it just has Defender on.
> it just has Defender on
It's unfortunate Defender would come pre-installed even on Server.
I do have ample personal experience - when government web server was randomly dropping from 2k req/s to 2 req/s we disabled defender and from there we had continuous 2k req/s. I have seen this literary hundreds of times. Not sure why people install AV on servers but its common in banks and similar. On home computers its even worst. I witnessed new laptop computer with 2 AVs - defender + something vendor installed like mcafe. It was so slow that while typing letters appeared 1/s.
AVs inject themselves on number of places and do all kind of "funky" stuff. All power users should disable that junk. You have other means to protect yourself. If you are grandma, sure, go for it, but grandma will not run "Reclaim Windows10" from github gist, no ?
Context is everything. It certainly doesn't justify above comment claiming "DO NOT DO THIS!!!" on HN. Its utter nonsense. We are here to talk about hacking things by definition. Power users customize their OS, not the other way around. Its pity that MS doesn't provide minimal OS (like Linux OS's usually do) but the first thing I do is not run single script like Reclaim, but dozen of such scripts and my healthy nervous system thanks me all the time because benefits are huge and minuses are minor and fixable.
If anything, we need more projects like that, more polished, more documented, more maintained. My personal fav so far is [1]
Oh, come on; there are issues like this: https://github.com/rust-lang/cargo/issues/5028 and the app developers do handstands in order to minimize the impact; for example, cargo guys had to redo their file closing on Windows to be done asynchronously, so they would not have to wait for Defender.
It's maybe the case if you're running a 15+ year old PC with the slowest spinning rust disk and 1GB of RAM.
Makes you wonder why they bother with any other Windows.
But even if the house is made of poo, shooting holes in the wall is not the way to fix it.
There really aren’t any winning moves other than not to play at all. Which may be an insane self sacrificing position.
Totally agree that MS deserves criticism as you correctly point out. However, criticism towards the script and similar is equally valid (and important).
I've seen some opinions, but none could be objectively evaluated as really pointing out problematic settings. They were more in the area of subjective preferences.
But this is exactly the point behind the criticism. The script is presented as “run this to make Windows better/safer”. If you did that without evaluating and understanding these subjective preferences, you might end up in a worse state than you started in, because maybe some of those preferences don’t really match your needs.
However, my biggest issue is simply bloat. With every major update on Windows 10 we get more and more crap running on the OS. A fresh install of Windows 10 21H1 uses 3Gb+ of RAM and that is insane. There are things like "YourPhone" which is an app that starts at boot and cannot be uninstalled which is supposed to help integrate your Android phone - I have an iPhone and couldn't use it even if I wanted to, but I still pay 4Mb of RAM for having it running. I can probably disable half the services that are set to start automatically and still have a working OS.
Tried using something like winreducer to actually strip out the binaries instead of just turning stuff off via registry, but it's tedious; nowadays I just do a regular install then go into task scheduler and remove 1/2 of the needless crap then manually disable 1/4th of the services and use some PowerShell scripts for removing un-removable apps.
I miss the good-old days of Windows 2000 where we booted the OS with < 90Mb RAM and a couple dozen processes.
I don’t understand why modern OS’s need multiple gigabytes of RAM just to boot. I get that they do more than NT4 and windows 2000 did, but still, why isn’t a gigabyte enough? I would like to read an OS engineer’s take on it.
You need 3GB RAM to open some web pages in your browser nowadays and that's insane.
I remember one machine, where I couldn't get sound blaster mouse, printer and modem to work at the same time.
I do agree that nowadays software companies expect to just own you if you use their products. The sad part is that what Microsoft is doing is "normal" or even minimal compared to what Apple or Google are doing. And it's getting worse all the time.
Fortunately Linux desktop is good enough this days for most tasks.
In the msdos days, an app was installed to a directory.
In the win 3.x days, an app was installed to a directory, created a program group OR shortcut on the desktop.
In the win95 days, an app was installed to a directory, created a program group AND shortcut on the desktop.
In the win98 days, an app was installed to a directory, created a program group, shortcut on the desktop and quicklaunch bar.
In the win98se days, an app was installed to a directory, created a program group, shortcut on the desktop, quicklaunch bar and systemtray when run.
In the winme days, an app was installed to a directory, created a program group, shortcut on the desktop, quicklaunch bar and systemtray when the system started.
In the winxp days, an app was installed to a directory, created a program group, shortcut on the desktop, quicklaunch bar, systemtray when the system started and changed your default homepage.
In the winvista days, an app was installed to a directory, created a program group, shortcut on the desktop, quicklaunch bar, systemtray when the system started, changed your default homepage and added toolbars on ie.
In the win7 days, an app was installed to a directory, created a program group, shortcut on the desktop, quicklaunch bar, systemtray when the system started, changed your default homepage, added toolbars on ie and showed ads when run.
In the win8 days, an app was installed to a directory, created a program group, shortcut on the desktop, quicklaunch bar, systemtray when the system started, changed your default homepage, added toolbars on ie and showed ads when the system starts.
In the win10 days, an app is installed to a directory, creates a program group, shortcut on the desktop, quicklaunch bar, systemtray when the system started, changes your default homepage, adds toolbars on ie/edge, shows ads when the system starts and constantly tries to convince you to use this program or install others.
I actually don't know if ie/edge still have default homepage or toolbars, but you get the idea.
Aren't people tired of fighting with their own computers? I abandoned Windows, installed Linux and can't be happier now.
Computers are chosen based on applications. If you want to play games, you are probably buying a Windows PC. Developing iOS apps? You want a Mac. If you just need a browser, then a Chrome Book or iPad is probably a good choice. I'd bet a lot of people here use three or more operating systems every day on different computers doing different things.
I think the very point of this thread is that is not the case and many users are very unhappy with Windows telemetry.
I like using Windows as much as macOS or Linux. For different parts of my day I'll be using Windows or Linux or Android or iOS and at on each system the OS is there to support the applications I want to use.
I wouldn't call Windows, Linux, or macOS walled gardens.
If this is not a walled garden, I don't know what is. Linux is certainly not a walled garden.
None of Windows, macOS, or Linux are walled gardens because all of them allow anybody to publish software for those platforms. You don't need approval and you don't need to distribute through a central authority.
iOS, on the other hand, can only load apps from the App Store and that store only carries software approved by Apple.
What you are talking about is proprietary software. That's a different beast.
No Windows version since XP has been fine. They varied from utterly unusable crap to barely tolerable. I honestly never understood why people use Windows, is there an argument other than "I'm used to it"? I still have a small Win partition installed for rare Win-only things and every single time I interact with Win 10 I remember how utterly broken it is. Like the moment you boot, you're bombarded with crap that has flashy colors, animation some even sound too. It feels like that one Futurama episode about AOL.
Yes. The argument is "I want to run X and it only runs (or runs best) on Windows|Linux|macOS. People don't fire up their computer because they want to use Linux or Windows, they fire it up because they want to play Assassin's Creed or XCode.
She tried very hard with Wine, PlayOnLinux, tried all sorts of alternative offices, VMs, but gave up and had to install Windows anyway because majority of people simply refuse to use open data formats and use proprietary closed formats.
I'm also running Windows because I have to do some CorelDraw drawings and don't want to bother with wine etc. Otherwise I would be running Linux for sure.
It's unconscionable to suggest that one needs multiple computers for various purposes when they are all general purpose computers on the inside.
All of this is enabled by software, which costs nothing at all to replicate unless it's restricted via copyright law. This is very much unlike every other hobby, where specialised tools cost money to duplicate.
By the time you've "reclaimed" Windows 10, there'll be an update that undoes your work, so it doesn't seem worth the effort.
It has most of the annoying things that plague consumer versions of Windows 10 stripped out, and it gets a very different cadence of updates, restricted to security and quality fixes. No Cortana, no Edge installed by default, no built-in Store universal apps.
It's rock solid; I have never gotten a bad update pushed to any of my boxes running LTSC over the past five years. If you want a Windows workstation that just works, and will continue to work without fiddling, this is it.
Windows comes with a lot of things I personally don't use, but I don't feel that I have to obsessively remove them all.
Are you sure this is a good thing? As much as I don't like Edge, aren't the alternatives either IE or no browser? It's not like they'll ship Firefox preinstalled instead.
In my experience, most editions of Windows 10 are simply unredeemable. You have to start with an LTSC edition, which behaves more like XP used to: Very little bloat, no forced patching, everything except what you actually need turned off by default.
Meanwhile, Microsoft recommends that you don't use LTSC. Prefer the normal editions. Use LTSC only if required. Please don't use LTSC. Don't disable Telemetry! LTSC is for special customers only. Use the Current Version for the latest features. The Current Version has many benefits that users enjoy! Consume Soylent Green! Eat it. Eat it.
On a side note, this also made me realize my desktop barely has any non-mainstream "low-trust" applications anymore. Back in the early 2000s, I remember my computer is filled with random win32 apps. The most fringe app I have now is "Bulk Rename Utility".
https://docs.microsoft.com/en-us/windows/powertoys/powerrena...
Having the snapd daemon running is not necessary (it may actually be undesirable).
At least on Ubuntu though, snapd can't be regularly prevented from starting at boot (`systemctl disable`) - it needs to be masked (`systemctl`, essentially, a forced disable). But if one masks it, the Ubuntu daily update will hang.
Well, one can't say that Ubuntu isn't catching up with the times :) /s
For people like us, there are so many other distributions that align more with our use cases. Manjaro or Fedora are just as good as Ubuntu, but for potentially more savvy users. Or if you really really need complete control nobody is stopping anybody from running Gentoo with OpenRC. Or, the most sensible option, just use Debian.
The whole point is to give the user choices, that's the entire purpose of the Gnu/Linux universe.
[0] https://docs.microsoft.com/en-us/windows/whats-new/ltsc/
Similar to Gmail and the likes of numerous SaaS companies. There's a freemium version with ads (or some type of limitation) or a paid version without ads (or said limitation).
Just playing devils advocate here.
Basically, tell an ISV (like Connection.com) that you want a small business relationship w.r.t. Microsoft Licensing and they'll set you up. You might have to buy a few random CALs to qualify, but it's totally possible and a godsend.
It's definitely not 2.4k lines to disable telemetry.
SmartScreen basically sends your files to Microsoft, for "enhanced security" or something.
FWIW I put Defender on notification only mode because Microsoft ever so helpfully removed the actual quarantine directory and now files dumped into quarantine are basically unrecoverable.
I just use the firewall with a third party interactive GUI and block anything that I can't identify.
No they haven't removed the quarantine restoration option. You can mark any file it quarantines as safe, and it gets restored and never flagged again.
what does this option do then?
https://www.howtogeek.com/wp-content/uploads/2017/08/img_599...
and of course: it's enabled by default
plus the T&Cs let them send whatever they want
Windows now behaves like mid 2000s malware, but with more ads
Yes, the quarantine is still there. But if Defender can't pull the file out, you can't just open the folder manually and cut-paste anymore. Your file for all intents and purposes is gone.
Granted most people will never have to worry about this.
Given that, still a great script!
[0]: https://community.spiceworks.com/scripts/show/4378-windows-1... [1]: https://community.spiceworks.com/how_to/148624-how-to-clean-...
I haven't personally used it but a friend of recommended it to me.
Anyone else have any experience with AME Windows?
The first thing to note is that Windows Update is completely removed, so unless you have fairly-current Windows 10 drivers, you'll never automatically download drivers. Asus doesn't provide an up-to-date ACPI driver, so my wife's laptop was always running at full throttle (which means constant fans) and couldn't sleep or hibernate, and several devices went unrecognized the entire time. Ultimately, I ended up reinstalling the retail version of Windows 10 that was included with the machine and after a few updates it's back to its initial state. Of note, I also tried Windows 8.1 (no drivers available) and Windows 10 LTSB (no ACPI drivers again).
For myself, I've had absolutely no issues with it. All my devices were recognized and it boots extremely quickly (~8 seconds from cold boot on a SATA SSD). Most of the stuff I didn't like about Windows 10 is ripped out. If you're a fairly technical user who's cautious about what they download and run, it might be ideal. I have no problem wiping my machine occasionally, so running without security updates isn't something I'm too bothered about.
I installed this to test it out (in a VM) and got a login prompt asking for a password. I went to their site and found no documentation about this at all, so I just never touched it again. It could be changed and no such prompt appears. I might have to try it again.
I've come to a conclusion that either you want an OS that respects your privacy, or you want Windows. These two are fundamentally incompatible and at most, you're going to end up doing damage control.
(Nestlé boycott) https://en.wikipedia.org/wiki/Nestl%C3%A9_boycott
(Nike boycott) https://www.theguardian.com/environment/green-living-blog/20...
(South Africa boycott) https://en.wikipedia.org/wiki/Dunnes_Stores_strike
Going into the registry is madness, especially when you're purchasing a license for the OS.
Personally I'm going to get a new mac when they get the ram up to 64GB with the new processors.
Concerning the other two, the Nestlé boycott does not seem to have had much, if any, impact, and it’s at least debatable if the Nike one did much, and if it did, then the impact is not due to informed individuals “speaking with their wallet”, but the wide publicity.
This is why I specified “consumer-level”; a boycott which includes continuous publicity from major media is no longer consumer-level.
“We got an awful lot of knocks back. People who we thought would have supported us: the Church, the government – who were all members of the Irish Anti-Apartheid Movement at the time,” she said.
The Dunnes strikers were given their greatest endorsement when the South African Bishop Desmond Tutu – at the time a vocal and renowned critic of apartheid – asked to meet them as he travelled to collect his Nobel Peace Prize in the December after the strike started.
https://www.thejournal.ie/dunnes-stores-strike-8-3690382-Nov...
If a boycott gets popular it's eventually going to get media coverage no?